Get-WindowsCapability -Name RSAT* -Online | Add-WindowsCapability -Online

Monitor Event Log ID 4624 (Logon) on servers for logon type 3 (Network) and 10 (RemoteInteractive) originating from client workstations.